Navigate to SSP on the subway map. Click on Detailed Plan.

Select a domain and click on a control that is marked as "Not Yet Satisfied".

Alert!
For a control to be fully met, each of the Objectives related to the control must be met.  There is no partial credit, as an adversary is likely to use any unmet objectives prior to attempting to exploit those that are met.

Under POA&M>Objectives Not Yet Met, click on the listed objectives to be able to edit them.

[a] Information flow control policies are defined.
Implement the tools and/or documentation to satisfy AC.2.016 (3.1.3) objective [a]: Information flow control policies are defined.

Click "Met" to mark this requirement as satisfied. This will update the SSP automatically. Likewise, for any future changes made to this selection.

Tip!
This status change will also automatically apply for the control in the Assess section of the subway map and the POA&M item that was pending completion.

Click out of the menu to go back to the SSP page for the selected control.

Tip!
The same process used for closing POA&Ms can apply to controls that are "Not Rated". This simply means that there is at least one objective in that control that has not been given a designation. 

Addressing POA&M Tools, Services and Documents

To address other POA&M items, select the different options that have the orange calendar icon to be brought to a menu for each item.

Vulnerability Scanning Service/Tool - open vas

Enter information for all of the required fields, highlighted in red.

Click "ACTIVE" to satisfy this item. It will be removed from the POA&M as a result. 

Addressing SSP Requirements